Program-controlled operation of repetitive events is well known. When applied to automotive vehicles, repetitive operations may, for example, be fuel injection or ignition timing pulses. U.S. Pat. No. 4,099,495, KIENCKE et al, assigned to the assignee of this application, discloses a control system for automotive vehicles, and more specifically an electronic control system to determine the timing of ignition pulses, fuel injection and the like, in which various signals appear which can be supervised or monitored for proper occurrence and function. U.S. Pat. No. 4,204,256, KLOTZNER, likewise assigned to the assignee of the present application, shows a program-controlled unit in which signals occurring therein can be used, directly, to obtain control or monitoring pulses. Various monitoring devices of program controlled apparatus have been proposed in order to monitor and supervise the proper sequencing of the programming steps. For example, it has been proposed to use test programs which are interspersed with the actual operating program in which the various functions of the program controlled apparatus are simulated. Depending on the type of the error signals or disturbance signals which are sensed, it is then possible to localize errors in the program. This type of monitoring is effective, but has the disadvantage that the program controlled system is not available for actual operation during the time that the test program is run, that is, the system is completely occupied by the test program. This is undesirable, particularly in such apparatus in which continuous processing of data is important. Use of test programs, therefore, in real-time control systems may lead to difficulties.
It has also been proposed to supervise program controlled apparatus by adding a control or check pulse to each sequence of pulses which occur during the program itself in order to show that the entire program is properly running. If such a control signal is used for continuous supervision of the apparatus, it is still possible that, if the control pulse is absent or lacking for only a short period of time, the entire apparatus is shut down.
It is disadvantageous that entire systems or apparatus are shut down in program controlled systems, particularly if the apparatus operates within an environment which is subject to substantial extraneous noise. Such conditions pertain particularly in automotive vehicle systems which use microprocessors, and especially in systems which are controlled by microprocessors. Automotive vehicles are particularly subject to stray noise pulses which are difficult to exclude--for example if the vehicle should pass close by a high-tension transmission line, adjacent an operative track system of electric railroads, or the like. It is particularly important that programs which control the operation of motor vehicles are operating under the programs as provided, for reasons of safety and operating efficiency. Monitoring systems must have devices which, upon recognizing malfunction, total loss, or interruption of the control of the vehicle, give an indication to the operator or trigger other apparatus in order to ensure safe operating condition of the vehicle, or which start an emergency program or an emergency function which permits at least some operation of the vehicle to a repair place or garage and which maintains those system functions which allow continued operation under safe conditions. Repair is costly for the user. It is thus necessary that monitoring systems shut down the actual program controlled apparatus only when it is absolutely necessary and to limit response of monitoring systems for those conditions in which the control system as such cannot function anymore at all. Loss of control pulses within a system is not a reliable indication, however, for complete failure of the control system since the excessive noise level in which the automotive electronic system operates frequently results in impression of short-time noise or blanking signals which may simulate substantial defects not actually caused by operating conditions. These spurious excess or blanking pulses may mask or cause loss of control pulses although they are not caused by actual breakdown of the control system as such.